Re: Quic: the elephant in the room

Ben Laurie <benl@google.com> Sat, 10 April 2021 10:38 UTC

Return-Path: <benl@google.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC3B33A2E28 for <ietf@ietfa.amsl.com>; Sat, 10 Apr 2021 03:38:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.599
X-Spam-Level:
X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PSjCZPWl5onB for <ietf@ietfa.amsl.com>; Sat, 10 Apr 2021 03:38:41 -0700 (PDT)
Received: from mail-vs1-xe2f.google.com (mail-vs1-xe2f.google.com [IPv6:2607:f8b0:4864:20::e2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F2DE3A2E26 for <ietf@ietf.org>; Sat, 10 Apr 2021 03:38:41 -0700 (PDT)
Received: by mail-vs1-xe2f.google.com with SMTP id 2so4189055vsh.4 for <ietf@ietf.org>; Sat, 10 Apr 2021 03:38:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xu06KiO0FS+Trs4wPliE+npWSpPurPINC+Tr8o539x4=; b=idi9VGerAnGjhjkXet0yGZXiyfKt+GJ01qEQMcjEbBYtRv9NsO8y10Uj4NMs+Frvj/ gloa5MBEUwuOBOQdWy5R0xDC2zTCFw24ttj/Z6Fk6UYc5fYMNTbsAwDw0Guo+Vpyg1TV 9B24kTWo/fvHaQfNGtEG8/8PplaDMU2z3eBZGKUEb1vhKLf7z3THwl5FB5cLnIgg1uV8 S94yfIKYxO1SZdbW+WShUz4tBpk3FEk8mUSwAQH9VQJvLXF1cW0wiUSGBxLqsvcMAH8f wvZNKH7KMn6TdqRpkR8Icd6WwLcBNXLX/mr7op8m8moim17iVJobiT5h/5V4tIwXbn73 9rJA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xu06KiO0FS+Trs4wPliE+npWSpPurPINC+Tr8o539x4=; b=XfB3SCVx+nn76837Yk7+4WggRZL5yB3qPXq0FpZWnlR+gIvpjJg7HsNNmNwdeFgiKD +wJknbd0j8o56eBjwhdHuk/yX4aQ4hBe30VJMamQD3zV+6UiZfYkoDBvWkZ2Gfks99J3 C0jfW0JqefqJJFZFoVLvpjgv1y6MDrWsCziZ7rkpi01TR21yp0TfEP8UHXTmIgDIp+jB YPyfbXa5Dm1hLPYydWoodIERP5O0OaDCl1d/tLyEu+zztlnDZeLVeMdGk8E+hOaOSCsq 9dXgrTzofK+ePNKpKwKUME2LnITO9sf5marIoK+xPvmmw95NUtTSwfvUM1L24iAkI94w x7Tw==
X-Gm-Message-State: AOAM530qls4BGPK6gvoeZhNNr3Ocz09LmqWG+mkw9ZMmvlTvWT4JYDps tOWVxiwp9vVmGCLL3etKevEErm+NNM9rNZ23qCRTyQ==
X-Google-Smtp-Source: ABdhPJyrXUD/zqK7UJlrI3pAVEKgQHxNn855VqBb2iyP0eCrDGvwbrjEgGN8ljcBXGqCdGn0qDdhKuA4VXk+fZPSnFk=
X-Received: by 2002:a67:b005:: with SMTP id z5mr14673771vse.47.1618051119123; Sat, 10 Apr 2021 03:38:39 -0700 (PDT)
MIME-Version: 1.0
References: <3b25c77d-e721-e86d-6c34-a90039aab0e2@mtcc.com> <CAMm+Lwhi8xwFgZJL7jod2g4urZt_f+dm0tNi+3y1osqOfch2mQ@mail.gmail.com> <3593a01f-73f4-7d03-a85b-dff64a8b070e@mtcc.com> <CABrd9STZXonBDvWB7Z36H2mD20Juubc01TUmEvpfWkvJggQVOQ@mail.gmail.com> <20210410094925.GA8697@nic.fr>
In-Reply-To: <20210410094925.GA8697@nic.fr>
From: Ben Laurie <benl@google.com>
Date: Sat, 10 Apr 2021 11:38:27 +0100
Message-ID: <CABrd9SSjVEEZteqwhmO4WyfovVLZiuvcc9x-gcvFwV01GKUTbw@mail.gmail.com>
Subject: Re: Quic: the elephant in the room
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>
Cc: Michael Thomas <mike@mtcc.com>, Phillip Hallam-Baker <phill@hallambaker.com>, IETF Discussion Mailing List <ietf@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000002f69c705bf9be21d"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/7_bNJl3QdT5ANUqFfNYNe7CgFhg>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 10 Apr 2021 10:38:47 -0000

On Sat, 10 Apr 2021 at 10:50, Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:

> On Sat, Apr 10, 2021 at 10:29:42AM +0100,
>  Ben Laurie <benl=40google.com@dmarc.ietf.org> wrote
>  a message of 138 lines which said:
>
> > However, the other problem is introducing DNS as a trust root - the
> > DNS hierarchy is considerably less secure than CAs were even before
> > CT but now it's really a very poor option in comparison.
>
> It doesn't matter since, if you control the DNS, you can have your
> certificate, anyway. So, it doesn't change the picture.
>

This is only relevant if the controller of the DNS is not the "right" one -
in which case, CT will reveal both the existence of the cert and the
implied DNS compromise, which they can then rectify. If DNS were the only
authority it would be much harder to detect.

So. it does matter.